Upgrade Kernel components

app/Http/Kernel.php

@@ -14,8 +14,9 @@ class Kernel extends HttpKernel
      * @var array
      */
     protected $middleware = [
+        \App\Http\Middleware\TrustHosts::class,
         \App\Http\Middleware\TrustProxies::class,
-        \App\Http\Middleware\CheckForMaintenanceMode::class,
+        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,
         \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,

app/Http/Middleware/Authenticate.php

@@ -3,6 +3,7 @@
 namespace App\Http\Middleware;
 
 use Illuminate\Auth\Middleware\Authenticate as Middleware;
+use Illuminate\Support\Facades\Session;
 
 class Authenticate extends Middleware
 {
@@ -10,12 +11,28 @@ class Authenticate extends Middleware
      * Get the path the user should be redirected to when they are not authenticated.
      *
      * @param  \Illuminate\Http\Request $request
-     * @return string
+     * @return string|null
+     * @phpcs:disable Squiz.Commenting.FunctionComment.TypeHintMissing
      */
     protected function redirectTo($request)
     {
-        if (! $request->expectsJson()) {
-            return route('login');
+        $logins = [
+            'backend' => route('bo.login')
+        ];
+        if (!$request->expectsJson()) {
+            // * Notify must login
+            Session::flash('warning', trans('Veuillez vous connecter pour continuer'));
+
+            foreach ($request->route()->gatherMiddleware() as $middleware) {
+                if (\is_string($middleware) and strpos($middleware, 'auth:') !== false) {
+                    $route = $logins[str_replace('auth:', '', $middleware)] ?? null;
+                    if ($route) {
+                        return $route;
+                    }
+                }
+            }
+            return route('bo.login');
         }
+        abort(401);
     }
 }

app/Http/Middleware/CheckForMaintenanceMode.php

@@ -1,16 +0,0 @@
-<?php
-
-namespace App\Http\Middleware;
-
-use Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode as Middleware;
-
-class CheckForMaintenanceMode extends Middleware
-{
-    /**
-     * The URIs that should be reachable while maintenance mode is enabled.
-     *
-     * @var array
-     */
-    protected $except = [
-            ];
-}

app/Http/Middleware/EncryptCookies.php

@@ -9,8 +9,7 @@ class EncryptCookies extends Middleware
     /**
      * The names of the cookies that should not be encrypted.
      *
-     * @var array
+     * @var array<int, string>
      */
-    protected $except = [
-            ];
+    protected $except = [];
 }

app/Http/Middleware/PreventRequestsDuringMaintenance.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance as Middleware;
+
+class PreventRequestsDuringMaintenance extends Middleware
+{
+    /**
+     * The URIs that should be reachable while maintenance mode is enabled.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [];
+}

app/Http/Middleware/RedirectIfAuthenticated.php

@@ -3,6 +3,7 @@
 namespace App\Http\Middleware;
 
 use Closure;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 
 class RedirectIfAuthenticated
@@ -10,15 +11,22 @@ class RedirectIfAuthenticated
     /**
      * Handle an incoming request.
      *
-     * @param  \Illuminate\Http\Request $request
-     * @param  \Closure                 $next
-     * @param  string|null              $guard
-     * @return mixed
+     * @param \Illuminate\Http\Request $request
+     * @param \Closure                 $next
+     * @param string|null              ...$guards
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
      */
-    public function handle($request, Closure $next, $guard = null)
+    public function handle(Request $request, Closure $next, ...$guards)
     {
-        if (Auth::guard($guard)->check()) {
-            return redirect('/home');
+        $logins = [
+            'web' => route('bo.eleveurs.index')
+        ];
+        $guards = empty($guards) ? [null] : $guards;
+
+        foreach ($guards as $guard) {
+            if (Auth::guard($guard)->check()) {
+                return \redirect()->to($logins[$guard]);
+            }
         }
 
         return $next($request);

app/Http/Middleware/TrimStrings.php

@@ -9,9 +9,10 @@ class TrimStrings extends Middleware
     /**
      * The names of the attributes that should not be trimmed.
      *
-     * @var array
+     * @var array<int, string>
      */
     protected $except = [
+        'current_password',
         'password',
         'password_confirmation',
     ];

app/Http/Middleware/TrustHosts.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustHosts as Middleware;
+
+class TrustHosts extends Middleware
+{
+    /**
+     * Get the host patterns that should be trusted.
+     *
+     * @return array<int, string|null>
+     */
+    public function hosts()
+    {
+        return [
+            $this->allSubdomainsOfApplicationUrl(),
+        ];
+    }
+}

app/Http/Middleware/TrustProxies.php

@@ -2,7 +2,7 @@
 
 namespace App\Http\Middleware;
 
-use Fideloper\Proxy\TrustProxies as Middleware;
+use Illuminate\Http\Middleware\TrustProxies as Middleware;
 use Illuminate\Http\Request;
 
 class TrustProxies extends Middleware
@@ -10,14 +10,19 @@ class TrustProxies extends Middleware
     /**
      * The trusted proxies for this application.
      *
-     * @var array|string
+     * @var array<int, string>|string|null
      */
-    protected $proxies = "*";
+    protected $proxies;
 
     /**
      * The headers that should be used to detect proxies.
      *
      * @var integer
      */
-    protected $headers = Request::HEADER_X_FORWARDED_ALL;
+    protected $headers =
+    Request::HEADER_X_FORWARDED_FOR |
+        Request::HEADER_X_FORWARDED_HOST |
+        Request::HEADER_X_FORWARDED_PORT |
+        Request::HEADER_X_FORWARDED_PROTO |
+        Request::HEADER_X_FORWARDED_AWS_ELB;
 }

app/Http/Middleware/VerifyCsrfToken.php

@@ -6,18 +6,10 @@ use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
 
 class VerifyCsrfToken extends Middleware
 {
-    /**
-     * Indicates whether the XSRF-TOKEN cookie should be set on the response.
-     *
-     * @var boolean
-     */
-    protected $addHttpCookie = true;
-
     /**
      * The URIs that should be excluded from CSRF verification.
      *
-     * @var array
+     * @var array<int, string>
      */
-    protected $except = [
-            ];
+    protected $except = [];
 }

app/Http/Middleware/XssSanitizer.php

@@ -38,6 +38,7 @@ class XssSanitizer
                 }
             } else {
                 $input = strip_tags($input);
+                $input = \filter_var($input, FILTER_SANITIZE_STRING);
             }
         });
         $request->merge($inputs);

app/Lib/ToolboxHelper.php

@@ -176,4 +176,42 @@ abstract class ToolboxHelper
         );
         return $text;
     }
+
+    /**
+     * * Register CSP report URI
+     *
+     * Put this function inside RouteServiceProvider,
+     * and call it in RouteServiceProvider::boot
+     *
+     * ! Use this in conjonction with kwaadpepper/exception-handler
+     *
+     * @return void
+     */
+    public static function cspReportRoute()
+    {
+        // * CSP REPORT URI, Please add /csp-report to VerifyCsrfToken $except middleware
+        \Illuminate\Support\Facades\Route::post('/csp-report', function () {
+            $isCspRequest = request()->header('Content-Type') === 'application/csp-report';
+            if (!$isCspRequest or !request()->json('csp-report') or !is_array(request()->json('csp-report'))) {
+                abort(401);
+            }
+            // * Flatten if needed
+            $cspReport = collect(request()->json('csp-report'))
+            ->flatMap(function ($v, $k) {
+                return [$k => is_array($v) ? collect($v)->flatten()->implode(', ') : $v];
+            })->all();
+            // * Filter array keys
+            $cspReport = collect(array_intersect_key($cspReport, [
+                'blocked-uri' => '', 'document-uri' => '', 'original-policy' => '',
+                'referrer' => '', 'violated-directive' => ''
+            ]));
+            report(new \Illuminate\Http\Client\HttpClientException(sprintf(
+                "CSP REPORT for %s : \n %s",
+                $cspReport->get('document-uri'),
+                $cspReport->implode("\n")
+            )));
+        })->middleware('throttle:5,2')
+        ->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class)
+            ->name('cspReportUri');
+    }
 }

app/Providers/RouteServiceProvider.php

@@ -2,9 +2,13 @@
 
 namespace App\Providers;
 
+use App\Lib\ToolboxHelper;
 use App\Models\CafelEggBreeder;
 use App\Models\CafelPoultryBreeder;
+use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Route;
 
 class RouteServiceProvider extends ServiceProvider
@@ -25,6 +29,20 @@ class RouteServiceProvider extends ServiceProvider
      */
     public function boot()
     {
+        $this->configureRateLimiting();
+
+        $this->routes(function () {
+            Route::middleware('web')
+            ->namespace($this->namespace)
+                ->group(base_path('routes/web-bo.php'));
+
+            Route::middleware('web')
+            ->namespace($this->namespace)
+                ->group(base_path('routes/web-fo.php'));
+        });
+
+        ToolboxHelper::cspReportRoute();
+
         Route::bind('breeder', function ($value) {
             /** @var \App\Models\CafelEggBreeder|null */
             if (!($breeder = CafelEggBreeder::whereCafelCode($value)->first())) {
@@ -33,50 +51,19 @@ class RouteServiceProvider extends ServiceProvider
             }
             return $breeder;
         });
+
         parent::boot();
     }
 
     /**
-     * Define the routes for the application.
+     * Configure the rate limiters for the application.
      *
      * @return void
      */
-    public function map()
+    protected function configureRateLimiting()
     {
-        $this->mapApiRoutes();
-
-        $this->mapWebRoutes();
-    }
-
-    /**
-     * Define the "web" routes for the application.
-     *
-     * These routes all receive session state, CSRF protection, etc.
-     *
-     * @return void
-     */
-    protected function mapWebRoutes()
-    {
-        Route::middleware('web')
-             ->namespace($this->namespace)
-             ->group(base_path('routes/web.php'));
-        Route::middleware('web')
-            ->namespace($this->namespace)
-            ->group(base_path('routes/web-bo.php'));
-    }
-
-    /**
-     * Define the "api" routes for the application.
-     *
-     * These routes are typically stateless.
-     *
-     * @return void
-     */
-    protected function mapApiRoutes()
-    {
-        Route::prefix('api')
-             ->middleware('api')
-             ->namespace($this->namespace)
-             ->group(base_path('routes/api.php'));
+        RateLimiter::for('web', function (Request $request) {
+            return Limit::perMinute(150)->by(optional($request->user())->id ?: app('clientIp'));
+        });
     }
 }

resources/views/auth/login.blade.php

@@ -8,7 +8,7 @@
                 <div class="card-header">{{ __('Connexion') }}</div>
 
                 <div class="card-body">
-                    <form method="POST" action="{{ route('login') }}">
+                    <form method="POST" action="{{ route('bo.login') }}">
                         @csrf
 
                         <div class="row mb-3">

resources/views/back/layout/header.blade.php

@@ -18,7 +18,7 @@
                 <!-- Authentication Links -->
                 @guest
                 <li class="nav-item">
-                    <a class="nav-link" href="{{ route('login') }}">{{ __('Connexion') }}</a>
+                    <a class="nav-link" href="{{ route('bo.login') }}">{{ __('Connexion') }}</a>
                 </li>
                 @if (Route::has('register'))
                 <li class="nav-item">
@@ -37,7 +37,7 @@
                             {{ __('Déconnexion') }}
                         </a>
 
-                        <form id="logout-form" action="{{ route('logout') }}" method="POST" class="d-none">
+                        <form id="logout-form" action="{{ route('bo.logout') }}" method="POST" class="d-none">
                             @csrf
                         </form>
                     </div>

routes/web-bo.php

@@ -4,14 +4,15 @@ use App\Http\Controllers\Bo\BreederController;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Route;
 
-Auth::routes([
-    'verify' => false,
-    'register' => false,
-    'reset' => false
-]);
-
-Route::prefix('bo')->name('bo.')->middleware('auth')->group(function () {
-    Route::resource('eleveurs', BreederController::class)->only(['index', 'show'])
+Route::prefix('bo')->name('bo.')->group(function () {
+    Auth::routes([
+        'verify' => false,
+        'register' => false,
+        'reset' => false
+    ]);
+    Route::middleware('auth')->group(function () {
+        Route::resource('eleveurs', BreederController::class)->only(['index', 'show'])
         ->parameter('eleveurs', 'breeder');
-    Route::redirect('/', '/bo/eleveurs');
+        Route::redirect('/', '/bo/eleveurs');
+    });
 });